f0f845e14a180789cf093fd4e51dba14_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0f845e14a180789cf093fd4e51dba14_JaffaCakes118
Size

3KB
MD5

f0f845e14a180789cf093fd4e51dba14
SHA1

db98c2db177836648c704115c2444fb20f1b7a95
SHA256

1daa1166201d2823eadd5774608919515b38647e652d469a5e63c804d96d0c19
SHA512

97319cd6b491cf6a9bc3720cdcf6e043d0a137141cb535fcaea2ed965b164ab1fae0ea9c56c30489b1e75ff89b80d077c2e8146dc61e5c22ee170e2dad1e2df3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0f845e14a180789cf093fd4e51dba14_JaffaCakes118

Files

f0f845e14a180789cf093fd4e51dba14_JaffaCakes118
.exe windows:4 windows x86 arch:x86

64f4da4ad6c469756a68ac175658b2fe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

kernel32

GetShortPathNameA
VirtualAlloc
GetModuleHandleA
ExitProcess
GetLastError
CreateProcessA
CloseHandle
WriteFile
CreateFileA
GetEnvironmentVariableA
lstrcatA
lstrcpyA
GetTempFileNameA
GetModuleFileNameA
MoveFileA
lstrlenA
VirtualFree
GetTempPathA

shell32

ShellExecuteA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE